[plug] USB flash data recovery

[caston at arach.net.au]

Quoting Daniel Foote <freefoote at gmail.com>:

> > grab a dd copy before you do anything further in both linux or doze.
> > Its probably too late, but its much easier to do this before it is
> > totally stuffed up (i.e., macs do some wonderful one way conversions
> > when you plug a stick into some of the older ones!, and doze revovery
> > utilities may not be successful, so an image means you get more goes at
> > it.)
> >
> > If all else fails, you can "strings" the image and can sometimes recover
> > something!
> 
> If the data is not actually scrambled on the disk (ie, the FAT is
> stuffed but the data is ok) you might be able to use something like
> Foremost (http://foremost.sourceforge.net/). G

Thanks Daniel, (and everyone else that replied)

I just got back from the job. It looks like she had been continuing to save
stuff to the memory key even after the corruption.

I was able to recover one of her assignments using the pc inspector data
recovery and by going through a whole bunch of .tmp files.

I did try the Linux based instructions I had on one of my own memory keys before
I left for the job but each step took a very time and she said it wasn't that
important.

regards,

Chris